WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Graphina – Charts and Graphs For Elementor versions = 3.1.12...

WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin Buddyboss Platform versions = 3.1.0...

WordPress The7 theme <= 14.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bonds in WordPress Theme The7 versions = 14.2.2...

WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Challan versions = 3.7.88...

WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jamaal ahmed in WordPress Plugin ARForms versions = 7.1.2...

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Kim Sang HPT Vietnam in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.4.6...

WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions = 3.1.0...

WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy Digital Downloads versions = 3.7.1...

CVE-2026-105397

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Zein in WordPress Plugin Social Rocket versions = 1.3.5...

WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin ListingPro versions = 2.9.12...

WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SafeSnap – Verified WordPress Backup & Restore versions = 2.1.2...

WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Museder RestoreOne versions = 2.7.276...

WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Norvis Backup versions = 1.1.0...

WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sitemovr versions = 1.0.1...

WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Snapshotify All-in-One Backup & Restore & Migrate versions = 1.3.2...

WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Tourfic Pro versions = 1.17.3...

EUVD-2026-92444

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

CVE-2026-105397

The LearnPress plugin for WordPress (versions through 4.4.9.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of input sanitization in the update_question AJAX handler , which allows authenticated users with the Instructor role to inject malicious scripts v...

CVE-2026-105397 LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...